42804602634
73%

Ran 10 Nov 2026 11:15AM UTC

Jobs 1

Files 1006

Run time 1min

Badge

Embed ▾

Committed 10 Nov 2026 11:05AM UTC coverage: 72.833% (+0.03%) from 72.8%

Build # 42804602634

Build Type

push

github

Committed by

web-flow

Commit Message

Restrict go-jose v3 imports with depguard (#7097)

The JWS guard from #7090 protects the two places where fosite parses
an untrusted JWT today, and an inventory test pins the routes and
fosite handlers that could add another. Neither catches new ToolHive
code that parses a JWT with go-jose v3 or fosite's token/jwt package
on an existing route, which would skip IsUnsafeJWS and reopen
GHSA-vvm8-gf78-28g4.

A depguard list now denies both packages in non-test code outside the
five files that already import them for types. A new importer fails
lint and has to join the list, so the change shows up in review. A
security rule covers what lint cannot see: new parsing inside a file
already on the list.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

94034 of 129109 relevant lines covered (72.83%)

858.25 hits per line

Coverage Regressions

Lines	Coverage	∆	File
6	72.34	-6.38%	pkg/secrets/keyring/keyctl_linux.go
1	94.26	0.0%	pkg/authserver/storage/memory.go
1	96.77	-3.23%	pkg/foreach/foreach.go
1	81.58	-0.12%	pkg/vmcp/composer/workflow_engine.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	42804602634.1	10 Nov 2026 11:15AM UTC	1006	72.83	GitHub Action Run

stacklok / toolhive / 42804602634
73%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42804602634

stacklok / toolhive / 42804602634 73%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42804602634

stacklok / toolhive / 42804602634
73%

README BADGES
x